200-201 Network Intrusion Analysis Practice Question
A junior analyst is reviewing a packet capture and sees a workstation repeatedly sending ICMPv4 Type 8 packets to an external IP address with varying payload sizes. The analyst wants to confirm whether this activity is a covert channel. Which characteristic of the ICMP traffic would most strongly suggest that the ICMP payload is being used to exfiltrate data?
⚠ Common exam trap
The trap here is focusing on packet timing or reply behaviour, which are normal for ping, instead of inspecting the payload content where covert data actually hides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ICMP payload data changes on every request and contains non-printable, high-entropy bytes.
Covert ICMP channels hide data inside the payload of echo requests and replies. Benign pings use fixed, printable payload patterns, so a payload that changes on every packet and contains high-entropy, non-printable bytes strongly suggests encoded data is being transmitted. Combined with an external destination, this pattern points to ICMP-based exfiltration rather than routine connectivity testing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ICMP payload data changes on every request and contains non-printable, high-entropy bytes.
Why this is correct
Legitimate ping payloads are usually fixed patterns such as alphabetic strings or zeros. When the payload varies on every request and contains high-entropy, non-printable bytes, it suggests data is being encoded into the ICMP data field for exfiltration. This is a classic indicator of an ICMP tunnel or covert channel, especially when combined with a consistent external destination.
- ✗
The ICMP echo requests are sent at a fixed interval of exactly one second.
Why it's wrong here
A fixed interval is typical of automated monitoring and heartbeat tools, not necessarily covert exfiltration. While some malware beacons at regular intervals, the interval alone does not prove data is being carried in the payload. The key indicator for a covert ICMP channel is anomalous payload content, not the timing of the requests. This option describes a benign polling pattern.
- ✗
The ICMP echo requests contain a consistent sequence number and identifier.
Why it's wrong here
Consistent sequence numbers and identifiers are normal for standard ping utilities, which use them to match replies. Their presence indicates ordinary reachability testing rather than covert data transfer. Covert channels typically randomize or repurpose these fields to encode data, so stable values would not be a strong indicator of exfiltration in this scenario. This option describes expected benign behaviour.
- ✗
The ICMP echo requests receive echo replies from the same external IP address.
Why it's wrong here
Receiving echo replies confirms basic connectivity and that the remote host is reachable. Normal ping operations always receive echo replies, so this is expected behaviour and not evidence of a covert channel. Covert ICMP tunnels may actually suppress replies or use them to return data, but the mere presence of replies does not indicate exfiltration. This option describes standard ICMP operation.
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.